Live › vulnerability › CVE-2026-107051
AndFHEM v2.4.1, an Android client for the FHEM home-automation server, has insecure permissions that let an unauthorized attacker change another user's FHEM control configuration. The attacker gains the ability to alter home-automation controls belonging to someone else.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 17:26 UTC. All times on this page are UTC.
Affects the AndFHEM Android app at version 2.4.1 (versionCode 241) that connects to FHEM home-automation controls. The sources do not say which configurations or deployments are exposed beyond the description, so whether a given install is at risk is unknown.
No product ranges from the sources yet.
adb shell dumpsys package <package name> and look for versionCode 241No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations.
This page as .md · .json · in your agent: get_signal("CVE-2026-107051")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.